Cowrie Research

collateral-admission-lag-and-borrow-side-quarantine

18 min read

Collateral Admission Lag and Borrow-Side Quarantine

  • Name: collateral admission lag and borrow-side quarantine
  • Category: solvency rollout reference / collateral-admission checklist / wrapper-pricing quarantine note
  • Summary: A price path can be locally coherent and still be too fresh, too manipulable, too operationally degraded, or too poorly understood to deserve immediate borrow-side authority. Healthy systems keep a three-step ladder explicit: the protocol can read or locally print a mark, the protocol can publish or recognize that mark as accounting truth, and only later the protocol may let borrowing, liquidation, or recursion honor it at scale. The sharp review habit is to keep those promotions mechanically separate in code and policy, because published collateral truth exists is still a weaker statement than this asset already deserves debt-capacity, liquidation, and recursive-leverage authority. This note exists to keep that last downstream distrust boundary explicit instead of leaving Moonwell cbETH, Aave CAPO, Venus LUNA, Venus ZKsync wUSDM, Lodestar, and Wise to imply it only through postmortems.
  • Why this note exists:
    • Many incidents are not just the price was wrong. They are the protocol let a freshly published, freshly inflated, or freshly degraded collateral mark become immediate solvency truth.
    • Oracle rollout safety, stale-feed handling, and vault-share safety all need a second boundary after local pricing and even after protocol-authored publication: the borrow side should earn trust more slowly than the read side and more slowly than wrapper-local accounting.
    • The useful analytical question is often not only could the protocol compute a number? but why was that number already published as meaningful accounting, and why was that published number immediately allowed to create debt, liquidate users, or support recursive leverage?

What this note means by collateral-admission lag and borrow-side quarantine

  • Collateral-admission lag means a newly repriced wrapper, vault share, LP token, capped-oracle overlay, or migrated feed path is observable before it is fully trusted as collateral.
  • Borrow-side quarantine means the protocol narrows what that fresh price can do while confidence is still being earned: lower collateral factors, lower borrow caps, isolated mode, disabled recursion, delayed liquidations, or temporary mint / leverage limits.
  • The design goal is not never trust wrapper prices. It is a fresh wrapper price should not inherit full balance-sheet authority on the same block it becomes readable.

The three downstream gates reviewers should not collapse

  1. Local mark or observation state
  • A wrapper, oracle adapter, CAP layer, or exchange-rate path can output a value that is locally meaningful enough to inspect, compare, or monitor.
  • That answer may still be too fresh, too attacker-authorable, or too semantically incomplete to deserve stronger protocol trust.
  1. Protocol publication or accounting-recognition state
  • The protocol may decide to publish that mark into cached accounting, user-visible balances, collateral dashboards, or other internal state that now treats the value as more than a raw observation.
  • This is already a stronger claim than the system can read a number, but it is still not the same thing as full borrow-side authority.
  1. Downstream collateral / borrow / liquidation authority
  • The strongest step is when the protocol lets the new mark mint debt capacity, trigger liquidations, support recursion, or otherwise spend deeper reserves against it.
  • This note lives at that last boundary, but it works better when reviewers keep the earlier two steps visible instead of flattening all three into price is live.

The main downstream-solvency controls

1. Delayed collateral enablement after repricing or publication events

  • A wrapper-price migration, new oracle adapter, exchange-rate regime change, cached-rate publication, or protective-overlay activation should not instantly flip an asset into full collateral usability.
  • The protocol should be able to observe or even publish the price before it lets users borrow heavily against it.
  • This matters for wrapper migrations like Moonwell cbETH, overlay paths like Aave CAPO, and exchange-rate-bearing wrappers like Venus ZKsync wUSDM.

2. Lower initial collateral factors and debt ceilings

  • Freshly repriced assets should usually begin with smaller collateral factors, lower market debt ceilings, tighter borrow caps, or isolated-market treatment.
  • The point is not only to reduce theft if the price is wrong. It is also to keep same-block exchange-rate fiction from compounding into protocol-wide solvency loss.
  • A wrapper asset can be locally correct and still too thin, too reflexive, or too poorly stress-tested to anchor large debt immediately.

3. Separate liquidation authority from price publication

  • The protocol should be able to read and monitor a new price before liquidators are allowed to enforce it against users.
  • Liquidation is the most unforgiving consumer of fresh pricing because it turns one bad mark into irreversible collateral transfer.
  • A healthy system can stage observe -> constrain -> enable borrowing -> enable ordinary liquidations instead of collapsing those steps into one activation.
  • The practical reminder is that published collateral truth exists still does not imply liquidators may already spend against that truth.

4. Explicit distrust of exchange-rate jumps and wrapper-local marks

  • Wrapper exchange rates, rebasing indexes, vault share prices, and LP rates deserve skepticism even when they come from canonical contracts.
  • The crucial question is not just did the wrapper report this value? but could an attacker cheaply print, donate into, or transiently distort that value faster than downstream markets can safely react?
  • This is the lesson preserved by Lodestar, Wise Lending, and Venus ZKsync wUSDM.

5. No recursive use during the distrust window

  • A freshly repriced collateral object should not immediately become fuel for looping, self-borrowing, self-liquidation, or further wrapper-on-wrapper leverage.
  • Even if one market caps direct borrowing, recursive collateral pathways can still turn a small pricing mistake into large protocol exposure.
  • Isolation mode, collateral-only usage, or prohibition on borrowing correlated assets are often part of the same quarantine boundary.

6. Exit-depth-aware haircuts, not only oracle correctness

  • A wrapper can have a technically correct exchange rate and still be economically unsafe as collateral if the redemption path, AMM depth, or unwind capacity is too thin for the debt it now supports.
  • Haircuts should reflect executable exit depth and redemption reality, not just local math correctness.
  • This is the same deeper lesson behind wrapper-side donation attacks and house-asset collateral incidents: locally computed value is not the same thing as debt the protocol can safely underwrite against live exits.

7. Fast rollback, asset-local pauses, and state-reset paths

  • If a repriced wrapper starts looking wrong, or if a feed enters a stale / circuit-breaker / suspended state, the protocol needs a narrow way to stop new borrowing, pause liquidations, or de-recognize the asset without shutting the whole system down.
  • Rollback paths matter because bots and recursive borrowers react much faster than governance.
  • A quarantine that cannot be re-tightened quickly is mostly documentation, not real safety.

8. Repay-only restoration before credit restoration

  • When a market is paused, repriced, or pushed into degraded mode, a healthy restart path does not jump straight from frozen back to full collateral authority.
  • The safer shape is narrower: zero or neutralize the risky feed first, unpause into a repay-only or repay-and-supply-only window, stage collateral-factor reductions or asset offboarding, then restore live feeds and liquidation rights only after the protocol has decided what fresh credit powers the market still deserves.
  • Venus LUNA is the clean reminder that protocol resumed should not mean all old collateral powers came back at once: the protocol set zero feeds, reopened for repayments, later restored non-LUNA feeds, set LUNA / UST collateral factors to zero, and only then continued the offboarding sequence.

What sound design looks like

  • Observation, publication, and solvency admission are separate events.
    • The protocol can compute a fresh wrapper price, choose later whether to publish or recognize it as meaningful accounting, and only after that grant it full collateral power.
  • Borrow-side authority grows in stages.
    • New or newly repriced collateral starts small: lower factors, lower debt ceilings, fewer borrow pairs, or isolated treatment.
  • Liquidation rights lag price activation.
    • The system avoids letting one fresh or half-understood price immediately seize user collateral.
  • Wrapper-local truth is not self-authenticating solvency truth.
    • Canonical exchange-rate reads still face a second distrust boundary before becoming borrowable value.
  • Emergency continuity is narrower than normal operation.
    • A market can reopen for repayments, supply-side unwind, or staged exits before it regains ordinary borrowing and liquidation powers.
  • Recursive exposure is disabled until the path proves itself.
    • The safest first live window is the one where a price mistake cannot reflexively fund more of itself.
  • Rollback is faster than monetization.
    • Operators can stop new debt creation or liquidation before a fresh pricing mistake becomes systemic bad debt.

Failure-prevention checklist

  • Treat every new wrapper, repricing path, exchange-rate jump, overlay activation, and fallback switch as a collateral-governance event, not only an oracle update.
  • Separate price readable from price can mint debt in code: fresh marks should default to collateral factor 0, isolated mode, or tightly capped exposure until explicit graduation criteria are met.
  • Stage activation in order: observe first, cap second, enable bounded borrowing third, and only then enable ordinary liquidations and recursive borrow pairs.
  • Keep the three promotions mechanically separate in code and monitoring: mark is readable, mark is published as collateral accounting truth, and mark has full borrow / liquidation / recursion authority should not collapse into one generic asset is live transition.
  • Apply asset-local caps that bind during the distrust window: debt ceilings, borrow caps, per-user limits, and correlated-borrow restrictions should all shrink the blast radius before humans need to react.
  • Disable or heavily constrain recursive use during rollout. A fresh wrapper mark should not immediately support looping, same-asset borrowing, or correlated leverage against the very thing establishing its own price.
  • Predefine the degraded-mode restart ladder too: zero-feed or equivalent borrow/liquidation suppression, repay-only or repay-and-supply-only reopening, collateral-factor reductions or asset-local offboarding, and only later staged restoration of live feeds and ordinary liquidation powers.
  • Put liquidation behind its own gate. If a new pricing path can still be wrong, stale, or semantically incomplete, the protocol should be able to observe it without immediately letting keepers seize collateral from it.
  • Haircut for executable exit depth, not only local mark correctness. Redemption bottlenecks, AMM depth, withdrawal queues, and strategy unwind latency belong in the same admission decision as the onchain exchange-rate formula.
  • Require explicit rollback and de-recognition controls per asset: pause new borrows, freeze liquidations, reduce collateral factor, isolate the market, or null out collateral recognition without shutting down the entire protocol.
  • Monitor for graduation-failure signals before and after activation: abrupt wrapper-rate jumps, utilization spikes, borrow-cap saturation, recursive self-borrow patterns, redemption queue stress, and divergence between wrapper-local accounting and executable exits.
  • Document what exact condition ends quarantine. If the answer is just after launch or once governance says so, the borrow-side boundary is still being enforced socially rather than technically.

Audit prompts

  • What exact event is trying to cross the boundary here: a brand-new market, a wrapper migration, a price-source swap, a defensive overlay, a direct donation, or a share-price jump from internal accounting?
  • Which functions first honor the new mark economically: borrow-power calculation, liquidation eligibility, reserve-factor logic, collateral-factor checks, cap enforcement, or recursive borrow routing?
  • Can the protocol publish or monitor this price while collateral factor stays 0 or near 0, or are observation and borrowability still fused into one state transition?
  • Which exact function or governance action upgrades published collateral truth exists into full borrow / liquidation / recursion authority exists, and what objective criteria gate that upgrade?
  • During the first block or first hour of activation, what is the maximum debt or forced-liquidation damage this asset could create if the mark is wrong but locally plausible?
  • Are liquidations allowed to consume the fresh or newly restored price before the protocol has proven paired-state alignment, redemption semantics, exit depth, and degraded-mode exit criteria?
  • If the market is coming back from a stale-feed or pause event, can the protocol reopen into repayments and exits first, or does unpause still automatically restore fresh borrowing and liquidation authority too?
  • Can the asset immediately support correlated borrows, self-borrows, or wrapper-on-wrapper recursion that would let a local mispricing finance more exposure to itself?
  • What independent reality constrains the haircut: executable redemption, observable secondary-market depth, withdrawal queues, strategy unwind latency, or just trust in a contract-local exchange rate?
  • If the mark changes sharply, can operators or automation pause new debt and liquidations for this asset faster than bots can monetize the gap?
  • What telemetry proves the distrust window is working: bounded debt growth, limited liquidation volume, no recursive loops, no abnormal exchange-rate jumps, and no sudden divergence between local accounting and realizable exits?
  • What exact objective criteria graduate the asset from quarantine, and what criteria force it back into quarantine if conditions deteriorate?

Lessons that should already be standard

  • We can read a price, we can publish that price as accounting, and we should lend against it are three different security claims.
  • Published collateral truth exists is still not the same thing as liquidators, recursive borrowers, and deeper reserves may already spend against it.
  • The first consumer of a fresh price should usually be monitoring, not borrowing or liquidation.
  • Liquidation is not just another downstream feature toggle. It is the irreversible edge of solvency policy and deserves a slower activation path than price publication.
  • Wrapper-local exchange rates are not self-authenticating collateral truth. Donation sensitivity, low-supply weirdness, queue friction, redemption semantics, and stale-feed degraded mode all survive even when the math is internally consistent.
  • Protocol resumed is not the same thing as full credit restored. Safe continuity often means repay-only or repay-and-supply-only first, with live borrowing and liquidation rights returning later if at all.
  • If recursive leverage is open during rollout, the quarantine is mostly decorative.
  • A reputable wrapper or blue-chip underlying does not remove the need for borrow-side distrust. The exploit surface sits in the wrapper path and the lending policy that honors it, not only in the brand on the collateral.
  • Asset-local rollback controls are part of the lending design, not an operations luxury. If the only emergency option is a whole-protocol pause, the protocol still lacks a mature collateral-admission boundary.
  • Graduation criteria matter as much as initial caps. A quarantine with no measurable exit conditions will either linger uselessly or get lifted for social reasons before the asset has actually earned trust.

Useful positive design shapes

1. Shadow-price period before collateral recognition

  • The protocol publishes and monitors the new wrapper or overlay price while collateral use remains off or heavily reduced.
  • The useful habit is that humans and automated monitors can compare what would happen before users are allowed to fund positions against it.
  • This is the downstream-solvency companion to oracle-migration-quarantine-and-canary-design.

2. Isolated-market warmup for wrapper assets

  • A wrapper, vault share, or LP receipt can begin in isolated mode with tight caps and no recursive borrow pairs.
  • The key design move is to localize mistakes to one asset and one bounded debt bucket while the system learns whether the valuation path is stable.
  • This is especially valuable when the asset’s exchange rate depends on donations, rebases, yield accrual, or thin redemption routes.

3. Liquidation grace window after a major repricing change

  • If the protocol changes how an asset is priced, healthy rollout can give operators and users a short window where liquidations are paused or heavily constrained while the new mark is validated.
  • The point is not generosity. It is to prevent a configuration or wrapper-interpretation mistake from instantly converting into forced collateral transfer.
  • Aave CAPO is the reminder that defensive overlays can still liquidate healthy users if paired state drifts.

4. Wrapper-rate changes treated as leverage events, not just oracle updates

  • A large exchange-rate move in a wrapper or vault share should be treated like a balance-sheet event even when the underlying reason is nominally legitimate.
  • Borrow growth, collateral-factor usage, and liquidation eligibility should be re-evaluated under the new rate before the full market is reopened.
  • This is how a healthy system avoids turning a locally computed wrapper mark into immediate leverage authority.

Negative exemplar cluster: what no borrow-side quarantine looks like

  • Moonwell cbETH — a wrapper ratio was treated as a finished dollar price and immediately drove both liquidations and bad debt.
  • Aave CAPO — a defensive overlay with misaligned paired state immediately became executable liquidation truth instead of a monitored canary.
  • Venus LUNA — a frozen oracle answer still retained live borrow authority for hours because the protocol had not yet narrowed the market into a repay-only or zero-collateral state.
  • Lodestar — a donated wrapper exchange rate was not merely observable; it was instantly borrowable against deeper protocol reserves.
  • Wise Lending — attacker-printed Pendle LP share value could immediately support borrowing, making presentation-layer exchange-rate fiction behave like collateral truth.
  • Venus ZKsync wUSDM — a thin wrapper’s locally inflated exchange rate controlled both collateral and liquidation math before the protocol imposed any meaningful distrust boundary.
  • The common lesson is not just prices were bad. It is the protocol let a fresh wrapper-side mark become immediate debt and liquidation authority.

Red flags that usually mean the collateral boundary is underdesigned

  • The wrapper price is onchain and canonical, so it is safe as collateral immediately
  • The oracle migration is done, so the market can open at full size now
  • Liquidations should turn on as soon as the feed is live
  • We can always lower caps later when recursive borrowing can already outrun the rollback path
  • The asset is only a wrapper around something safe as if wrapper exchange-rate logic and redemption routes were not their own solvency surface
  • The exchange rate was correct locally used as if local correctness proved executable unwind capacity or manipulation resistance
  • Isolation mode is unnecessary because the asset itself is reputable

Design questions worth asking first

  • What exact repricing event happened here: new adapter, wrapper migration, exchange-rate jump, CAP layer, fallback switch, or donation-inflated rate?
  • Why was the new price immediately allowed to support borrowing or liquidation rather than entering a narrower observation state first?
  • During the first live window, what was the maximum debt or liquidation damage this asset could create?
  • Could the asset be used recursively, against correlated borrows, or across sibling markets before the new price path proved itself?
  • What independent exit or redemption reality constrained the haircut, if any?
  • Could operators pause new borrowing or liquidations on this one asset faster than bots could monetize a bad mark?

How this note complements the exploit corpus

  • Start here when the design question is what should happen after a fresh wrapper price becomes readable or even protocol-published, but before that price becomes borrowable or liquidatable truth?
  • Use oracle-migration-quarantine-and-canary-design when the broader question is how a new oracle path should enter production at all.
  • Pair with stale-price exploitation when the sharper question is how a halted or degraded feed should lose borrow-side authority before the protocol restores ordinary market powers.
  • Pair with vault-share-truth-security-object when the asset’s own exchange-rate logic, donation sensitivity, or low-supply behavior is the upstream reason this distrust boundary is needed.
  • Pair with reward-recognition-presentation-and-collateral-separation when the sharper upstream question is when pending rewards, cached NAV, rebasing balances, or other wrapper-local repricing should even graduate into presentation truth before this note asks when they may become lending truth.
  • Pair with recursive-borrow-suppression-for-fresh-collateral when the sharper downstream question is not only should this fresh mark be borrowable yet? but what exact borrow pairs, loops, and liquidation rails should stay closed while trust is still being earned?
  • Drop into oracle-configuration failure when the protocol itself published the wrong wrapper or overlay price.
  • Drop into share-price manipulation or empty-market exchange-rate inflation when the protocol honored a manipulable exchange rate as collateral truth.
  • Compare against protocol-native collateral fragility when the deeper issue is not a wrapper’s freshness or manipulability, but that the protocol lent against its own thin house asset.

Internal linkages

Control surface

Graph View

Backlinks